Read the docs
TI-2025-40536 Aliases CVE-2025-65998GHSA-jqg8-m35q-jh7j

Apache Syncope: Default AES key used for internal password encryption

Priority LOW 39CWE-321Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and GitHub. Impact type from CWE-321.

Summary

Apache Syncope can be configured to store the user password values in the internal database with AES encryption, though this is not the default option. When AES is configured, the default key value, hard-coded in the source code, is always used. This allows a malicious attacker, once obtained access to the internal database content, to reconstruct the original cleartext password values. This is not affecting encrypted plain attributes, whose values are also stored using AES encryption. Users are recommended to upgrade to version 3.0.15 / 4.0.3, which fix this issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00529 44th percentileScored 2026-11-07
Fix Fixed org.apache.syncope:syncope-core (Maven): 4.0.3, 3.0.15

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Syncope2.1 – 2.1.14; 3.0 – 3.0.14; 4.0 – 4.0.2—No fix listedCNA
—org.apache.syncope:syncope-core (Maven)4.0.0 to before 4.0.34.0.3Patch availableGHSA-jqg8-m35q-jh7j
—org.apache.syncope:syncope-core (Maven)before 3.0.153.0.15Patch availableGHSA-jqg8-m35q-jh7j
  • Apache Syncope VendorApache Affected 2.1 – 2.1.14; 3.0 – 3.0.14; 4.0 – 4.0.2 Fixed in — No fix listed CNA
  • org.apache.syncope:syncope-core (Maven) Vendor— Affected 4.0.0 to before 4.0.3 Fixed in 4.0.3 Patch available GHSA-jqg8-m35q-jh7j
  • org.apache.syncope:syncope-core (Maven) Vendor— Affected before 3.0.15 Fixed in 3.0.15 Patch available GHSA-jqg8-m35q-jh7j

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:syncope:*:*:*:*:*:*:*:*2.1.0 – 2.1.14; 3.0.0 to before 3.0.15; 4.0.0 to before 4.0.3VulnerableApache
  • cpe:2.3:a:apache:syncope:*:*:*:*:*:*:*:* Versions 2.1.0 – 2.1.14; 3.0.0 to before 3.0.15; 4.0.0 to before 4.0.3 Vulnerable ·Apache

Remediation

  • Fix · GHSA-jqg8-m35q-jh7j org.apache.syncope:syncope-core (Maven) Fixed in 4.0.3 Advisory →
  • Fix · GHSA-jqg8-m35q-jh7j org.apache.syncope:syncope-core (Maven) Fixed in 3.0.15 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-65998
  2. 2026-10-03 Alias added: GHSA-jqg8-m35q-jh7j

References

Advisory 3

Other 3

  • TI-2025-35632 Apache Syncope: Remote Code Execution by delegated administrators CVSS 3.1HIGH 7.2
  • TI-2026-38503 Apache Syncope: Remote Code Execution via Scripted Connector CVSS 3.1CRITICAL 9.8
  • TI-2026-45025 Apache Syncope: RCE via Groovy Sandbox bypass CVSS 3.1CRITICAL 9.8
  • TI-2026-44406 Apache Syncope: User self-service privilege escalation CVSS 3.1CRITICAL 9.8
  • TI-2026-41245 Apache Syncope: SQL injection vulnerability in Audit Events search CVSS 3.1CRITICAL 9.8
  • TI-2026-38491 Apache Syncope: Remote Code Execution via Flowable BPMN Groovy ScriptTask CVSS 3.1CRITICAL 9.8
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences